ICT incidents and DORA
Notification of a major incident through eDesk, a classification decision that has to be prepared before the incident, and no aggregated reporting.
- The video of every lesson, and the word-for-word transcript beside it
- Every claim linked to its primary source, with a source register per lesson
- An assessment for each of the 6 modules, and an end-of-course assessment
- A printable certificate carrying your name, the date and the content version
- The downloadable artefacts and one page references for this course
Expensing it? The invoice can be made out to your firm, with its VAT number and your purchase order reference. Buying for several people: seats for a team.
The narrated video runs about 45 minutes across the 18 lessons. That is short on purpose: no filler and no reading out of the law, with the work in the transcripts, the sources, the assessments and the artefacts.
Module 6. The obligations that catch people out
Notifying a major information and communication technology incident under DORA and Circular CSSF 25/893, the three stage cycle that turns a published priority into a thematic review or a common supervisory action, and the whistleblowing channel that obliges you to build something whether or not anybody ever uses it. Lesson 6.1, ict incidents and dora. Lesson 6.2, thematic reviews and common supervisory actions. Lesson 6.3, the whistleblower, and what it obliges you to build.
Every instrument this lesson is built from, linked to its official text
Regulation (EU) 2022/2554, applicable since 17 January 2025, is the framework, and Circular CSSF 25/893 of 27 May 2025 is how a major incident is actually notified in Luxembourg: through the dedicated eDesk procedure or the machine to machine interface, individually rather than in aggregate, with any outsourcing of the reporting itself declared to the CSSF.
- Regulation (EU) 2022/2554 on digital operational resilience for the financial sector EUR-Lex, the official journal text. Applicable since 17 January 2025. Chapter III carries the management, classification and reporting of information and communication technology related incidents https://eur-lex.europa.eu/eli/reg/2022/2554/oj
- Circular CSSF 25/893 of 27 May 2025 CSSF circular. The practical arrangements for notifying major information and communication technology related incidents and significant cyber threats, through the dedicated eDesk procedure or the machine to machine interface https://www.cssf.lu/en/Document/circular-cssf-25-893/
Module 6. The obligations that catch people out
- Lesson 6.1. ICT incidents and DORA 2:22 · this page
- Lesson 6.2. Thematic reviews and common supervisory actions 2:25
- Lesson 6.3. The whistleblower, and what it obliges you to build 2:23
Open this lesson
Access to CSSF Readiness: requests, inspections and observation letters opens the video, the word-for-word transcript, the module assessments and the certificates. If you already have access, sign in and this page becomes the lesson.
Or watch lesson 1-1 of this course free, with no account: CSSF Readiness: requests, inspections and observation letters, the free sample.